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Abstract. Let C be a supersingular genus-2 curve over an algebraically closed 
field of characteristic 3. We show that if C is not isomorphic to the curve 
ip = x^ + 1 then up to isomorphism there are exactly 20 degree-3 maps i/p 
from C to the elliptic curve E with j-invariant 0. We study the coarse moduli 
space of triples (C, E, </?), paying particular attention to questions of rational- 
ity. The results we obtain allow us to determine, for every finite field k of 
characteristic 3, the polynomials that occur as Weil polynomials of supersin- 
gular genus-2 curves over k. 



1. Introduction 



Over an algebraically closed field of characteristic 3, every supersingular genus-2 
curve C has a degree-3 map to the supersingular elliptic curve E with j-invariant 0. 
^ ' We study the coarse moduli space A of such maps C —^ E, paying special attention 

C^ . to questions of rationality. We show that with a single exception, every super- 

singular genus-2 curve over an algebraically-closed field of characteristic 3 has 20 
non-isomorphic maps to the elliptic curve with ^'-invariant 0, and we provide explicit 

f^ ' equations for these maps. 

\^ . Our motivation for studying these maps is the question of determining which 

^D ' isogeny classes of abelian surfaces over a finite field contain Jacobians. Much has 

been written on this question P|31|l|SlElH[I31[ni[ini[iniIIHlIISl,and together the 
works just cited answer the question for all simple non-supersingular isogeny classes. 
In recent joint work jJO], Enric Nart, Christophe Ritzenthaler, and the author de- 
veloped techniques to address the non-simple isogeny classes and the supersingular 
isogeny classes, thus completing the determination of the isogeny classes of abelian 
surfaces over finite fields that contain Jacobians. However, to avoid various special 
cases, the arguments in jT^ concerning supersingular isogeny classes assume that 
C^ ' the characteristic of the base field is larger than 3. The characteristic 2 case is dealt 

with in jJS]. In this paper, we use our results on the moduli space A to answer 
the question for supersingular isogeny classes in characteristic 3. We obtain the 
following theorem: 

Theorem 1.1. Let q — i'^ he a power of 3. If d is odd, then the polynomials that 
occur as the Weil polynomials of supersingular genus-2 curves over ¥q are: 

(1) {x^ + q){x^ - sx + q) for all s G {±V3g}; 

(2) {x-'+qf, ifq>3; 
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(3) x^ + q^; 

(4) x"^ + qx'^ + q^; 

(5) x'^ ~ 2qx'^ + q^ , ifq>3. 

If d is even, the polynomials that occur as the Weil polynomials of supersingular 
genus-2 curves over ¥q are: 

(1) (x^ - 2sx + q){x'^ + sx + q) for all s e {±^9}; 

(2) (x^ -sx + qf for all s G {0,±^}; 

(3) (a;2 - 2sx + qf for all s G {±J^}, if q > 9; 

(4) x* + q^; 

(5) X* — sx^ + qx^ — sqx + q^ for all s E {±y^}. 

To prove these results, we show that the moduh space A is isomorphic to the 
coarse moduh space B of pairs (C, G), where C is a supersingular genus-2 curve in 
characteristic 3 and G is an order-4 subgroup of ( Jac C) [2] that is not isotropic with 
respect to the Weil pairing. We give explicit models for these moduli spaces, as 
well as for the maps from these spaces to the moduli space of supersingular genus-2 
curves in characteristic 3. 

In Section 121 we provide some basic facts about supersingular genus-2 curves in 
characteristic 3; in particular, we show that the coarse moduli space S of such curves 
is isomorphic to the afRne line. In Section |31 we classify the degree-3 maps from 
supersingular genus-2 curves to the j-invariant elliptic curve in characteristic 3. 
We show that the coarse moduli space A of such maps is isomorphic to the afhne 
line with one point removed, and that the natural map A —^ S has degree 20. 
In Section ^ we give complete lists of the isomorphism classes of supersingular 
elliptic curves over every finite field of characteristic 3, and we calculate the Weil 
polynomial of each isomorphism class. Finally, in Section[3we use the results of the 
earlier sections to determine which isogeny classes of supersingular abclian surfaces 
in characteristic 3 do not contain Jacobians, thereby proving Theorem ll.il 

Notation. If X is a scheme over a field K, and if L is an extension field of K, we 
let X]^ denote the base extension of X to L. 

Acknowledgments. The author is grateful to Enric Nart and Christophe Ritzen- 
thaler for encouragement and helpful discussions. 

2. Basic facts about supersingular genus-two curves in 
characteristic three. 

In this section we determine the locus of supersingular genus-2 curves in char- 
acteristic 3, viewed as a subvariety of the coarse moduli space of genus-2 curves. 

If fc is a field, we set 5^ = A| \ {[0, 0, 0, 0, 0]} and we let W be the orbit space of 
Sk under the action of k* defined by 

X[X1,X2,X3,X4,X5] = [X^Xi,X'^X2,X^X3,X^X4,X^°X5], 

so that M^ is a weighted projective space. We denote the orbit of [xi, 2:2, X3, 0:4, ^5] 
by [xi : X2 '■ X3 : Xi : x^,]. Igusa [Q associated to every genus-2 curve over k an 
element [J2 : J4 : Jq : Js ■ Jio] of W such that Jio ^ and 4J8 = J2J6 — Jl- This 
element is the vector of Igusa invariants of the curve. Igusa showed that over an 
algebraically closed field, every element of W with Jio ^ and 4Js = J2J& — J4 
comes from a genus-2 curve, and two genus-2 curves have the same vector of Igusa 
invariants if and only if they are isomorphic to one another. (Note, however, that a 
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point of this variety that is rational over a subfield of k does not always come from 
a curve defined over that field.) Thus, Igusa determined the coarse moduli space 
A^2 of genus- 2 curves. 

Theorem 2.1. Let k be a field of characteristic 3. 

(a) Let C be a genus-2 curve over k and let [J2 : J^ : Jq : Js '■ Jio] be its vector of 
Igusa invariants. Then C is supersingular if and only if J2 — Ji — Js = 0- 

(b) Let A and B be elements of k, with B ^ Q. Then the curve 

y2 = 3,6 _|_ ^2,3 ^ Bx + A^ 

is a supersingular curve of genus 2, and its vector of Igusa invariants is 
equal to [0 : Q : A : Q : B]. 

Proof. First we dispose of an annoying special case. Suppose fc = F3 and C is the 
curve y^ = x^ — x. Then C is not supersingular (because its Weil polynomial is 
f^ — 2t^ + 9) and its vector of Igusa invariants is [1 : : — I : — 1 : — 1]. 

If k is larger than F3, or if C is any curve other than y^ = x^ — x, then C has a 
model over k of the form dy^ — x^ + c^x^ + c^x^ + c^x'^ + C2x'^ + cix + co, where the 
polynomial in x is separable. Now we use the criterion for supersingularity given 
in [2i}| Lemma E, p. 387]: Let M and M^^^ be the matrices 



M 



C2 ci 
C5 C4 



M(3) 



Then C is supersingular if and only if MM^'^'' — 0, and the Jacobian of C is 
isomorphic to a product of supersingular elliptic curves (that is, the Jacobian is 
superspecial) if and only if M = 0. (Actually, to apply j20[ Lemma E, p. 387] 
we should write our curve as y^ = (quintic). However, the proof in 20 works for 
curves of the form y^ — (sextic) as well.) 

We note in passing that M ^ 0, because a polynomial of the form x^ + c^x^ + 
Co is not separable. This shows that there are no superspecial genus-2 curves in 
characteristic 3, as we know already from TT!, Prop. 3.1]. 

Note that 

MM(3)= [^2+cici C2cl + cicl 

C^C^ + C4cg C5CJ -I- c| _ 

Suppose the curve is supersingular, so that this matrix is the zero matrix. If C5 = 
then we must have C4 = C2 = 0, so C can be written in the form dy^ = x^ + cax^ + 
cix + cq. On the other hand, if C5 is nonzero then we can translate a; by a constant in 
order to get a new equation for C of the form dy"^ = x^+C5X^+C3X^+C2x'^+ciX+Co. 
Then we find that C2 = ci = 0, so C is of the form dy^ = x^ + c^x^ + c^x^ + cq. If 
we replace x with 1/x and rescale y, we find that we can again write C in the form 
dy^ = x^ + c^x^ + CiX + Cq. 

One can calculate that the Igusa invariants of the curve dy"^ = x^+csx^ + cix+cq 
are [0 : : Cg — cacf — Cq : : — cf]. (The computer algebra system Magma |21 
provides facilities for calculating Igusa invariants.) This proves the 'only if part of 
statement (a). 

If we take C3 = A, ci = B, cq = j4^, and d ^ 1, we find that the Igusa invariants 
are [0:0: -AB^ : : -B^] = [0 : : A : : B]. Thus, any curve with J2 = J4 = 
Jg = is geometrically isomorphic to one of the form y^ = x^ + Ax^ + Bx + A^ , and 
the criterion from [20] shows that this curve is supersingular. This proves statement 
(b) and the 'if part of statement (a). D 
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Given a supersingular genus-2 curve C over a field of cliaracteristic 3, we let 
Ic = Ji/Jfoi where [0 : : Je : : Jio] is the vector of Igusa invariants of C. 

Theorem 2.2. Let k be a field of characteristic 3. 

(a) The map 

{k-isomorphism classes of \ i, 

supersingular genus-2 curves over k\ 

that sends C to Ic is surjective, and is bijective if k is algebraically closed. 

(b) If c is a nonzero element of k, then the curve C defined by 

y^ =x^ + (?x^ + e'x + c'* 

is supersingular and satisfies Ic ~ c- The curve C defined by y^ — x^ + \ 
is supersingular and satisfies Ic — 0. 

(c) Let C be a supersingular genus-2 curve over k. The geometric automor- 
phism group of C has order 2 if Ic 7^ 0, and order 10 if Ic — 0. 

Proof. Given any nonzero c, let C be the curve y'^ — x^ + c?x^ + c^x + c*. It is easy 
to check that Ic — c. Likewise, it is easy to check that the Igusa invariants of the 
curve C defined by y^ = a;^ + 1 are [0 : : : : 1], so we have Ic = 0. This proves 
statement (b) and the surjectivity claim of statement (a). 

Suppose C and C" are supersingular genus-2 curves, with Igusa invariants [0 : 
: A : : B] a,nd [0 : : A' : : B'], respectively Then Ic = A^/B^ and Ic = 
{A'f/{B'f. Let A be a 10th root of B'/B. If/c ^ Ic then we have (yl')^ = A^^A^, 
so A' = C,\^A for some 5-th root of unity Q. If we replace A with A/C, then we have 
B' ^ X^"B and A' = A^A, so [0 : : A : : B] = [0 : : A' : : B'l and C and 
C" arc geometrically isomorphic to one another. This proves the bijectivity claim 
of statement (a). 

Finally, we note that Igusa ^1 §8] calculated the automorphism groups of all 
genus-2 curves in every characteristic. In characteristic 3, the only curve with 
automorphism group larger than {±1} is the curve with Igusa invariants [0:0:0: 
0:1], whose automorphism group is cyclic of order 10. This proves statement (c). 

D 

Remark. Results similar to Theorem 12.11 can be found in |21l §6] (see also the 
corrections in j^ §5]). 

Remark. Let S denote the coarse moduli space of supersingular genus-2 curves in 
characteristic 3. We have shown that the invariant Ic gives an isomorphism from 

5 to the affine line A^. 

3. Supersingular genus-two curves as triple covers of elliptic 

CURVES. 

In this section we classify all of the degree-3 maps (p: C ^ E over a given base 
field of characteristic 3, where C is a genus-2 curve and _E is a supersingular elliptic 
curve. We start by writing down a family of such maps. 

Let fc be a field of characteristic 3, and let b and c be nonzero elements of k. Let 
Ei,^c be the elliptic curve 

y = X — bx -\- c 
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and let Cb,c be the genus-2 curve 

u;2 = c(v^ - bv^ - b^v + b^ - c'^){v^ + bv^ - b^v - b^ - c^). 

Lemma 3.1. There are degree-3 maps 

fb,c '■ Cb,c — > Eb,c and ip^^^ : Cb,c — > E-b,c 

that induce an isogeny 3acCb,c ~* Eb,c x E-b,c- 

Proof. Let 

X = -bc{v - b)/(v^ - bv^ - b^v + b^ - c^) 

z = ~w/{v^ - bv^ - b'^v + b^ ~ c^) 

y = (z + bxz)/c. 

One can check that then y^ — x^ — bx + c, so these equations define a degree-3 map 
'Pb,c '■ Cb,c -^ Eb.c- Replacing b with —b in the definition of tfb,c gives a degree-3 map 
ip'f^ c- ^b,c —^ E-b.c- It is an easy exercise to pull back the invariant differentials of 
Eb_c and E^b.c to Cb^c and to show that the puUbacks are linearly independent; it 
follows that the induced map Jac Cb^c — > £'6,c x E^b.c is an isogeny. D 

Theorem 3.2. Suppose C is a curve over a field k of characteristic 3, and suppose 
ip: C ^ E is a degree-3 map from, C to a supersingular elliptic curve E over k. 
Then there exist nonzero b,c (£ k such that the cover (p: C ^ E is isomorphic 

Vb,c'- Cb,c — > Eb^c- 

Proof. The Riemann-Hurwitz formula shows that the degree of the different of Lp is 
2, so either there are two geometric points of C each contributing 1 to the different, 
or there is one geometric point contributing 2 to the different. A ramification anal- 
ysis as in [3 §7.2] shows that no point can contribute 2 to the different; therefore, 
the triple cover ip must have exactly two ramification points P and Q, both tame. 
Let k{C) be the function field of C and let k{E) be the function field of E. We can 
choose a generator z for fc(C) over k{E) whose trace to k{E) is 0; then z satisfies 
an equation z^ — fz ~ g for two functions / and g on E. From \7\ §7.2] we see 
that / has odd order at a point of E if and only if that point contributes an odd 
amount to the different of ip; therefore we must have 

div / = P + Q + 21? - 2oo 

where _D is a degree-0 divisor that is rational over k. We can write 

D = —R + oo + div r 

for some function r and some point R on E, both rational over k. Replacing z with 
z/r, the function / with f /r'^, and g with g/r^, we still have z^ — fz — g, but now 
the divisor of / is P -I- Q — 2P. (Note that P and Q must be distinct because there 



The analysis in 12 §7.2] assumes that the base field is finite and that the cover has been 
written in a certain standard form. However, for the ramification analysis all we need to know is 
that the cover can be put in the standard form locally everywhere, and this is true. 

We should note that there is an error in §7.2], starting at the second full paragraph on page 
1717. The error is in the statement that either 2 ordp g > 3 ordp / or ordp g ^ mod 3, except 
when P = oo and ordp g = —3. While this is true when ordp / = 0, it can fail when ordp / = 1. 
What is true is that for every P ^ oo for which ordp / > 0, there is a constant cp G k such that 
either 2 ordp (g + c^ — cpf) > 3 ordp / or ordp(g + Cp — cpf) ^ mod 3. This change affects 
the statement in the final paragraph of |7| §7.2]. See |S] for more details. 
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are two ramification points, and R must be distinct from both P and Q, because 
otherwise the function / would have a single zero and a single pole.) Now we can 
change coordinates on E so that R is the point at infinity. After this change of 
coordinates, we have P + Q = in the group law on E. Let the equation for E be 
y^ = x^ — bx + c, where 6 7^ 0. Then the function / must be of the form / = d{x — a) 
for some a € k and d d k*. Shifting x by the constant a does not change the form 
of the equation for E, but now we may assume that f = dx for some nonzero d e fc. 
Since P and Q are distinct and both are zeros of /, we see that c 7^ 0. 

We know from 7", §7] that by translating z by functions on E, we can modify g 
so that it only has poles at the poles of /; thus we may assume that the only pole 
of g is at 00. Furthermore, using the statement from the first full paragraph on 
page 1717 of |Zj, we see that we can modify g so that it has at most a triple pole 
at c». Therefore, we may assume that g is a linear combination of 1, x, and y. By 
shifting z by an appropriate constant to eliminate the multiple of x appearing in 
this linear combination, we may assume that g is a linear combination of 1 and y. 

Now we use the statement from the final paragraph of 7, §7.2], as corrected in 
the footnote above. We know that there are constants cp and cq in k such that 

2 ordp(g + c% - cpf) > 3 ordp / = 3 
and 

2ordQ(5 + c|-CQ/) > Sordg/^S. 

The functions on the left-hand sides of these inequalities have degree at most 3, so 
their orders at P (and Q) are either 2 or 3. This means that the two lines 

(1) .g + 4-cp/ = and 5 + ^ - cq/ = 

must be the tangent lines to i? at P and Q. 

Let us write P — {0,yp) and Q — {0,yQ), with yg =^ —yp- Then the tangent 
lines to £' at P and Q are given by 

(2) ypy ~bx~yp = and ygy - bx - yg = 

Note that the slopes of the lines defined by the these two equations are negatives 
of one another, and the same is true of the y-intercepts of the two lines. Applying 
the first of these two observations to the lines defined in |^ shows that cq = —cp. 
Applying the second observation then tells us that there can be no constant term 
appearing in the function g; that is, g = ey for some constant e € fc. Finally, by 
using this formula for g and the fact that the two pairs of lines Q and Q are 
equal, we find that we must have b^e^ + c^d^ — 0. Since b, c, and d are nonzero, so 
is e. 

We have shown that the triple cover C oi E can be written in the form 

y^ = x^ — bx -\- c 
z"^ — dxz — ey 



(3) 



where 6, c, d, and e are nonzero elements of k that satisfy b^e^ + c^d^ = 0. It is 
convenient to rescale the variables in these equations to get a more standardized 
form. Let r be a nonzero element of k, and replace z with rz, d with d/r^, and e 
with e/r^. Then the equations (O still hold, but the ratio c/e has been replaced 



SUPERSINGULAR GENUS-TWO CURVES 7 

with the ratio cr^ /e. If we choose r ~ ~{be)/{cd), then 

In other words, we may scale our variables so that e = c, from which it follows that 
d = -b. 

We can find new equations defining C by setting 

V = —b + {z — c)/x 
w = -z{v^ - bv^ - b^v + b^ - c^). 
A straightforward computation then shows that v and w satisfy 

u;2 = c{v^ - bv^ - b^v + b^- c2)(v3 + bv^ - b^v -b^- c^), 
and that we have 

X ^ -bc{v ~ b)/(v^ - bv^ - b^v + b^~ (?) 
z = ~wl(y^ - bv^ - b^v + &^ - ?) 
y = {z^ + bxz)/c. 

This shows that any given genus-2 triple cover of a supersingular elliptic curve over 
a field k of characteristic 3 is isomorphic to a cover (pf,_c : Cb,c ~> Ei,^c for some 
nonzero b and c in fc. D 

Corollary 3.3. // C is a genus-2 triple cover of a supersingular elliptic curve in 
characteristic 3, then C is supersingular. D 

Note that if C is a triple cover of a supersingular elliptic curve, then the right- 
hand side of the equation for C factors into a product of two cubics. The converse 
is true as well. 

Theorem 3.4. Let C be a supersingular genus-2 curve over a field k of characteris- 
tic 3, and write C in the form y^ — f for a sextic polynomial f . If f can be written 
as the product of two cubic factors, then C is a triple cover of a supersingular 
elliptic curve. 

Proof. Neither the hypothesis nor the conclusion of the theorem depends on which 
model for C we choose, so we may replace the given / with any sextic that defines 
the same curve. 

First we note that some quadratic twist of C can be written in the form y^ = /, 
where 

f ^ x^ + Ax^ + Bx + A^ 

for some elements A, B E k with B ^ 0. For curves with Ic y^ this follows from 
Theorem 12. 2f c^: for curves with Ic = this follows from explicitly writing down 
the twists of the curve y^ = x^ -\- I. 

If we replace x in this equation with —Bx, and if we replace y with B^y, we see 
that the new variables satisfy an equation of the same form as above, only now the 
new B has the property that —B is a square. 

Let gi and 52 be monic cubics such that / = (71(72- Elementary manipulations 
show that the coefficients of x^ in gi and 52 are negatives of one another, and they 
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are both nonzero. Likewise, it is easy to show that the sum of the coefficients of x 
in gi and 52 must be the square of the coefficient of x^ . Thus we may write 

gi = X -\- ux + u vx -\- w 

g2 — X — ux + u (1 — v)x + t 

for some elements u,v,w,t of k with u ^ 0. Setting 3152 equal to /, wc find that 
we must have 

t = w + u^{v'^ - v) 
and 

w{v + l) = -u^{v^~v^ + 1). 

The latter equality shows that v ^ —1. 

For z = 1, 2 let /li be gi evaluated at x + u{v + 1) . If we let c be a square root 
of —B/u^ (which is possible because of the way we adjusted B at the beginning of 
the proof), then we have 

hi — X + ux — Wx + u — c 

h2 = X — ux — u X — u — c . 

Thus some quadratic twist of our curve C is isomorphic to the curve Cu.c- But it 
is easy to see that a quadratic twist of a curve C'b^c is isomorphic to a curve of the 
same form, so in any case, C is a triple cover of an elliptic curve. D 

Next we note that different (6, c) pairs can give rise to isomorphic covers fb,c- 

Lemma 3.5. Let b, c, and r be nonzero elements of k. Then the cover 

is isomorphic to the cover ipb,c'- Cb.c —^ E^^c- 

Proof. We can view the cover Lpb,c '■ Cb,c —^ E^.c as being given by the equations lpj)l. 
with e = c and d = —b. If we let X — r^x and Y — r^y and Z = r^z, then these 
equations become 

Z^ + br*XZ = cr^Y, 
which are the equations defining the cover 

D 

Let A denote the coarse moduli space of triples {C,E,ip), where ip: C ^ E 
is a degree-3 map from a supersingular genus-2 curve in characteristic 3 to a su- 
persingular elliptic curve. Let B denote the coarse moduh space of pairs {C,G), 
where C is a supersingular genus-2 curve in characteristic 3 and G is an order-4 
subgroup of ( Jac C) [2] that is not isotropic with respect to the Weil pairing. There 
is a map k: A^ B that sends {C,E,(p) to (C, (ker (p* ) [2] ) . Recall that S denotes 
the coarse moduli space of supersingular genus-2 curves, and in Section |21 we gave 
an isomorphism S ^ A^. 

Theorem 3.6. Let notation be as above. 
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(1) The map n: A ^ B is an isomorphism. 

(2) The function that sends a cover (pb c to c'^ /b^ induces an isomorphism A —>■ 
Ai\{0}. 

(3) Under the isomorphisms A -^ A^\{0} and S -^ A^ given above, the natural 
map A -^ S that sends (C, E, ip) to C is given by the function 

Proof. If C is a genus-2 curve over a field of characteristic not 2, there are 35 
geometric order-4 subgroups of (JacC)[2]. Of these subgroups, there are 15 that 
are isotropic with respect to the Weil pairing. Therefore, the degree of the natural 
map B ^' S is 20. 

Let C denote A-'^ \ {0}, and let t be the map from C to ^ that sends c to Ci^c- 
Lemma l3 . 51 shows that c and — c have the same image in A, so the degree of t is at 
least 2. It is easy to compute that 

(4) Ic ^Jl±^ 

SO the composition C ^ A ^f S has degree 40 and the map A ^ S has degree at 
most 20. But A^r S factors through the degree-20 map B ^r S, so we deduce that 
k: ^ ^ yS is an isomorphism and that t has degree 2. In particular, this proves 
statement (1). 

We also see that A is isomorphic to the quotient of C by {±1}. This quotient is 
itself isomorphic to A^ \ {0}, and the isomorphism can be chosen so that the point 
on A corresponding to ipb,c gets sent to the point c^ /b^ of A^ \ {0}. This proves 
statement (2). 

Statement (3) follows from equation Q. D 

Remark. Suppose C is a genus-2 curve defined by y^ — /, where / is a degree-6 
polynomial. Suppose g is a cubic factor of /. Then we can associate to g the 
subgroup of (JacC)[2] whose geometric points are the divisor classes that can be 
represented by divisors of the form P — Q, where P and Q are Weierstrafi points 
whose ^-coordinates are roots of g. The Weil pairing on two such divisors is given 
by the cardinality (modulo 2) of the intersection of their supports, so the subgroup 
associated to g is not isotropic. Since there are 20 cubic factors of / (over the 
algebraic closure) and 20 non- isotropic geometric order-4 subgroups of (JacC)[2], 
we can view the moduli space B as the space of pairs {f,g), where y^ = f is a 
supersingular genus-2 curve and g is a cubic factor of /. 

4. Supersingular elliptic curves over finite fields of characteristic 

THREE 

In this section we list the different isomorphism classes of supersingular elliptic 
curves over finite fields of characteristic 3. We specify how the different isomorphism 
classes are Galois twists of one another, and we compute their traces of Frobenius. 
This information will enable us to compute the Weil polynomials of supersingular 
genus-2 curves in Section [S] 

Let E be the elliptic curve y'^ = x^ — x over F3. For every finite extension Fg 
of F3, we will express all the isomorphism classes of supersingular elliptic curves 
over ¥q as twists of E. 
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Condition on b 


Condition on c 


# Aut E' 


Cohomology class 


Trace 


X,Ab) = 1 


Trc/s(6)3 = 


6 


{±1} 





X,,2(6) = 1 


Trc/s(6)3 = l 


6 


{cj,-u;^} 


(_3)(d+l)/2 


XqMb) = 1 


Trc/s(6)3 = 2 


6 


{~LU,U^} 


_(_3)(d+l)/2 


x,Ab) - -1 


(no condition) 


2 


{±t,±tW,±tw2} 






Table 1. The twists E' : y"^ 



bx + c oi the eUiptic curve 



y 



X over ¥^d , when d is odd. 



Let i € Fg be a square root of —1. Let u, u, and tt be the following endomorphisms 
of E'lg: 



l: 


(a; 


y) "-" 


{~x 


liy) 


uj: 


(x 


y) ^ 


(x- 


-i,y) 


tt: 


[x 


y) ^ 


(x3, 


y'). 



One can check that the following relations hold in End Er,j 



LUJ = UJ i, 



— TTl, 



vrcj, 



TT = 1 + 2a;. 



The automorphism group A of EJ^ is the group of order 12 generated by l and uj. 
Let 9 = S'' be a power of 3. The twists of Er^ are catalogued by the pointed 
cohomology set H^{Ga\(¥q/¥g),A). We identify a cocyle Ga\{¥q/¥q) -^ A with 
the image of the g-power Frobenius automorphism in A; using this identification, 
we view a cohomology class as a set of elements of A. We let the reader verify that 
when d is odd (so that the Galois action on A is nontrivial) we have 

H\Gsi\{¥g/¥q),A) = {{±l},{uj,~uj^},{~uj,uj^},{±i,±LUj,±iuj^}}, 

and when d is even (so the Galois action on A is trivial) we have 



H\Gali¥g/¥g),A) 



{{l},{-l},W,u;'}A-^, 



-UJ^},{L,iUJ,iUJ^},{- 



-LUJ, —LUJ' 



'■})■ 



Every supersingular elliptic curve E' over ¥q can be written in the form y^ = 
x^ — bx + c with 6^0, and every curve of this form is supersingular. In Tabled 
we enumerate the isomorphism classes of the twists of E in the case that d is 
odd, and we show how one can determine the cohomology class corresponding to a 
supersingular elliptic curve E' from the coefficients b and c of its defining equation. 
The verification of the table is a straightforward exercise; we simply note that the 
Frobenius endomorphism of the twist of E by the cohomology class containing an 
automorphism C, can be taken to be Ctt'*, where tt is the Fa-Frobenius of E (as 
above). The table refers to the quadratic character Xq-2'- F* -^ {±1} defined by 



Xq,2{x) 



"^^/^ and to the absolute trace function Tr: F„ ^ Fq. The table also 



uses the notation s{b) to denote the quantity &(3-g)/4. gjjj(,g g = 3 mod 8, we see 
that s{b) is always a square, and when 6 is a square, s(6) is the unique square root 
of b that is itself a square. 

In Table |21 we enumerate the isomorphism classes of the twists of E in the case 
that d is even. The table refers to the quartic character XqA'- ^5 ^ {±li=tO 
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Condition on b 


Condition on c 


# Aut E' 


Cohomology class 


Trace 


X,Ab) = 1 


Trc/53/2 = o 


12 


{1} 


2(-3)'*/2 


Trc/5^/V0 


6 


{^,^n 


_(_3)<i/2 


x,Ab) - -1 


Trc/63/2 = 


12 


{-1} 


-2(-3)'^/2 


Trc/b^/^O 


6 


{-^,-^2} 


(-s)-^/^ 


XqA{b) = i 


(no condition) 


4 


{ — t, — tW,— tW^} 





XqAib) = -i 


(no condition) 


4 


{t,iW,tCj2} 






Table 2. The twists ^': y^ 



6a; + c of the eUiptic curve 



y 



X over ¥^d , when d is even. 



defined by Xq,2{x) = x'^'' ^^Z'' and to the absolute trace function Tr: F^ ^ F3. The 
conditions that involve h^'^ do not depend on the choice of the square root of b. 

5. Weil polynomials of supersingular genus-two curves in 
characteristic three 

In this section we determine the polynomials that occur as Weil polynomials 
of supersingular genus-2 curves over finite fields of characteristic 3. In fact, for 
every polynomial that occurs as the Weil polynomial of a supersingular genus-2 
curve over F^, we show how to quickly construct an explicit curve with this Weil 
polynomial. 

To begin, let us record for convenience a list of the Weil polynomials of super- 
singular abelian surfaces over the finite fields of characteristic 3. 

Lemma 5.1. Let q — 3^ be a power of 3. If d is odd, then the polynomials that 
occur as the Weil polynomials of supersingular abelian surfaces over ¥g are: 



sx - 

„'2. 



q){x'^ -tx + q) for all s,t e {0,±y/3q}; 



(1) ix' 

(2) x^ + ^ , 

(3) x"^ + qx'^ +g2; 

(4) x'^ -2qx^ +q'^. 

If d is even, the polynomials that occur as the Weil polynomials of supersingular 
abelian surfaces over Fg are: 

-tx + q) for all s,t e {0, ±y^, ±2^}; 



qx^ — sqx + q^ for all s G {±y/g}. 



(1) (x2 - 


- sx 


+ q)i 


(2) x4 + 


e-: 




{3)x^- 


9 

qx 


+ 1'; 



(4) x^ 



Proof. We already know the Weil polynomials of the supersingular elliptic curves 
over ¥q, and on each of the lists in the lemma, item (1) gives the Weil polynomials 
of the products of these curves. The remaining polynomials on each list correspond 
to simple abelian surfaces; this follows from |14l Cor. 2.8, Thm. 2.9]. The cited 
results also show that the lists are complete. D 

To prove Theorem 11.11 then, we must go through the lists in Lemma 15.11 and 
determine which entries come from genus-2 curves. 

Proof of Theorem \l.l\ We begin with the case when the degree of ¥q over F3 is 
even. The result when q = 9 can be obtained by direct computation, so we will 
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Condition on b 


Condition on c 


s 


t 


XqAb) = 1 


Tr,,/F, c/63/2 ^ 


2(-3)''/2 


2(-3)''/2 


Ti>^/F, c/6^/^ =±l±i 


_(_3)^/2 


-(-3)''/^ 


TrF,/F,c/6^/^e{±l,±*} 


2{-iYr^ 


-(-3)'^/^ 


X,Ab) = -1 


Tl>,/F, c/63/2 = 


-2(-3)'^/2 


-2(-3)'*/2 


TrF,/Fo c/6^/^ = ±1 ± i 


(-3)'^/2 


(_3)./2 


Ti>,/F,c/6^/^e{±l,±z} 


-2(-3)''/" 


(_3)<i/2 


XqAih) = ±J 


(no condition) 









Table 3. The conditions on h and c that determine the Weil poly- 
nomial [x^ — sx + q){x^ — tx + q) of the curve Cb,c, when q ~ 3'^ 
and d is even. The function Xg,4 is the character defined in Sec- 
tional 



assume that q > 9. We begin by providing, for every Weil polynomial in the second 
list in Thcorem ll.il a curve with that Weil polynomial. 

Items (1), (2), and (5): The split polynomials. For each of the polynomials listed 
in items (1), (2), and (3) we can find a curve Cb.c with that Weil polynomial. This 
is clear from Tabled in which we give simple conditions on b and c that determine 
the Weil polynomial of the curve Cb,c- It is easy to use Lemma [3. II and Table |21 to 
verify that the entries of Table 13 are correct. 

Item (4): The polynomial x^ + q'^ . Let a G F^ be a nonsquare, and let C be the 
curve 



y 



z^ + z^ 



1 



over Fq . Over . 



we can write C as 



y 



(z — \J —az + az — a\/—a — l){z + \J —az + az + a\J —a — 1) 



so that Cf 2 is isomorphic to C /^^ j^ . It is easy to check that the isogeny 

from Lemma IST1 descends to give an isogeny from Jac C to the restriction of scalars 
of E^fzr^ 1 . We see from Table |21 that the Weil polynomial of E^r^^ ^ is x^ -I- q"^ 
(because the square root of a nonsquare in ¥q is a nonsquare in F^2 , when g is a 
power of 9, because the group F*2/F* has order 2 mod 4), so the Weil polynomial 
for C is x^ + q^. 

The polynomials x"^ — sx^ 



Item (5): 



qx 



sqx 



whe 



= q. Let / = 



x'* — sx"' + qx" — sqx + q^, where s is a square root of q. The main result of [5] shows 
that the isogeny class of abelian surfaces corresponding to / contains a principally 
polarized variety A. We see from ^^ Table 1, p. 325] that the simple variety A 
remains simple over F^2, and ^1 Thm. 4.1] then shows that A is the Jacobian of 
a curve over Fg. 

(One can also construct explicit curves with these Weil polynomials as follows. 



Note that the map 



Fg given by z 



is not surjective, because and 



1 both get sent to 0. Therefore there is a nonzero c G F, such that the polynomial 
— c has no roots in Fg. The discriminant of g is — c^, which is a square 
in Fg, so a result of Pellet ^7] shows that g has an even number of irreducible factors 



g^z^ 
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s 


t 


5 


T 


-2(-3)'^/2 


_(_3)d/2 


2g'* 


'<!' 


_(_3)d/2 





_,. 


-2q^ 





(_3)<^/2 


-2q'^ 


-,' 


i-sr/' 


2(-3)''/2 


-,' 


2q'^ 


-2(-3)'^/2 





2q'^ 


-2q'^ 





2(-3)'^/2 


-2q^ 


2q'^ 


_(_3)rf/2 


(_3)./2 


-q' 


-q' 


-2(-3)'^/2 


2(-3)''/2 


2q'^ 


2q'^ 



Table 4. Certain split Weil polynomials {x^ — sx + q) {x^ — tx + q) 
over ¥q , and the corresponding Weil polynomials {x'^ — Sx+q) (x^ — 
Tx + q) over F^2 . Here g = 3 for an even number d. 



of even degree. Since g has no linear factors, it follows that g is irreducible. Then 
F„5 is the smallest extension of F^ over which the Jacobian of the supersingular 



curve C: y = z{z^ 



c) has rational 2-torsion points, so the Weil polynomial 



of C is not any of the polynomials hsted in items (1) through (3) of the second hst 
in Lemma l5.ll The only possibility remaining is that C and its quadratic twist give 



us the two Weil polynomials x 



sx^ + qx'^ 



sqx + q , where s — q.) 



Of the polynomials given in the second list of Lemma 15.11 we have shown that 
those that appear in the second list of Theorem ll.ll do occur as the Weil polynomials 
of Jacobians; now we must show that the remaining polynomials from the second 
list of Lemma 15.11 do not come from Jacobians. We begin with the split isogeny 
classes. 

In Table 01 we list the split Weil polynomials over F^ that we must show do not 
occur. Suppose C is a curve over F, with one of these Weil polynomials. Write 
C as y^ — f for some sextic polynomial / G Fq[z]. If / has a cubic factor, then 
Theorems 13.41 and 13.21 together with Lemma [3. II and Table 13 show that the Weil 
polynomial for C cannot factor in the way we have assumed. (The key fact to notice 
is that the quartic character XqA takes the same value on b and on —6.) Therefore, 
the polynomial / is either 

• an irreducible sextic; 

• the product of a linear polynomial with an irreducible quintic; 

• the product of a quadratic polynomial with an irreducible quartic; or 

• the product of three irreducible quadratics. 

Corresponding to these factorizations of /, we obtain information about the reduc- 
tion of the Weil polynomial of C modulo 2. In the four cases listed above, the Weil 
polynomial modulo 2 is 



1); 



• 


{x^ +x 


+ 1)2 


• 


[x* + x^ 


+ x' 


• 


{x + \Y 


; and 


• 


{x^lf 
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Note that the first four Weil polynomials in Table0]do not factor modulo 2 in any 
of these ways, so these first four polynomials do not occur as the Weil polynomials 
of Jacobians over F^. 

For the next two entries in the table, we notice that the corresponding Weil 
polynomials over F^2 are both (x^ — 2qx + q^){x'^ + 2qx + q^). We see that / is 
therefore not the product of a linear polynomial and an irreducible quintic. Looking 
at the other possible factorizations of / over Fg, we see that / must have a cubic 
factor over Fg2. Once again, Theorem 13.41 Theorem 13.21 Lemma f3. II and Table [21 
show that this Weil polynomial over ¥^2 cannot occur. 

For the penultimate entry in Table 01 we again use Theorem 13.41 Theorem 13.21 
Lemma 13.11 and Table (21 We find that over Fg2 , our hypothetical curve C must 
be isomorphic to Ch^c for some 6, c £ Fg2 where 6 is a fourth power and where the 
absolute traces of cj}?!'^ and of c/{-~bY/'^ are both nonzero. Using Lemma [3. 51 we 
can assume that fe = 1, so that c G Fg2 now has the property that c and ic have 
nonzero trace to F3. It must certainly be the case that c has nonzero trace to Fg. 
Now, we know from equation Q) and from the fact that C is defined over Fg that 
we must have 

(£-tl)!eF 

Applying Lemma 15.21 f below) with r = 9, we find that c must actually lie in Fg. 
From this it follows that C is a twist of the curve Ci.c over Fg. But again using 
Lemma [3.11 and Table (21 we see that Ci_c has Weil polynomial [x"^ + 3'*/^x + g)^, 
so the Weil polynomial of C must be either (a;^ + i'^^'^x + q)"^ or (x^ — 3'^/^a: + q)"^. 
This contradicts our assumption that C has Weil polynomial {x^ + Z'^/^x + q){x^ — 
S^/^x + g). 

We turn to the final entry in Table 01 Write our hypothetical curve C as dy^ = f 
for some nonzero d in Fg and some degree-6 polynomial /. From what we have 
already noted, we know that / is either the product of three irreducible quadratics, 
or is the product of an irreducible quartic with a quadratic. In either case / has a 
cubic factor over Fg2. Theorem 13.41 Theorem 13.21 Lemma [3.1 1 and Table (21 show 
that Cr 2 is isomorphic to Cb^c for some b,c € F*2 , where 6 is a fourth power and 
where the trace of c/b^^^ from Fg2 to Fg is equal to 0. Without loss of generality, we 
may assume that b — 1. Equation Q) shows that (1 + 0^)^/0"^^ lies in Fg2 (indeed, 
it lies in Fg), and applying Lemma 1531 (below) with r = 9 and Q = q^ shows that 
all of the geometric points of A lying above the point Pc of S corresponding to C 
are rational over Fg2. Therefore all of the geometric points of B lying above Pc 
are rational over Fg2 , and it follows that all of the geometric cubic factors of / are 
rational over Fg2 ; in other words, / splits completely over Fg2 . Hence we see that 
/ must be the product of three irreducible quadratics over Fg . 

At the beginning of the proof of Theorem l2.1l we showed that every supersingular 
genus-2 curve over Fg can be written in the form dy^ = z^+C3Z^+ciz+co, so we may 
assume that our polynomial / has the form of the right-hand side of this equation. 
Then the discriminant of / is — c^, and since Fg is an even-degree extension of 
F3, the discriminant is a square. But a polynomial over a finite field with a square 
discriminant has an even number of irreducible even-degree factors |17| , so / cannot 
be the product of three irreducible quadratics. This contradiction shows that there 
is no supersingular curve over Fg whose Weil polynomial is given by the final entry 
in Tabled 
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Finally, we must show that there is no supersingular genus-2 curve with Weil 
polynomial x^ — qx^ + q^. If there were such a curve C over F^, then reasoning 
as above shows that C must be given by an equation y^ = (sextic), which shows 
that Cf 2 has a degree-3 map to an elliptic curve. In fact, since the quadratic twist 
-D of Cf 2 has Weil polynomial {x'^ + qx + (f'Y' , we find from Table O that D is 
isomorphic to Ci,c for some c S ¥^2 whose trace to Fg is ±1 ± i. But since Z? is a 
twist of a curve over F^ , we know that 

_ (c« + If 

^D 7:53 



is an element of F,. Then Lemma f5.2l shows that c must be an element of ¥q, so 
our original curve C is a twist of a curve Ci^c- But Ci^c has a split Jacobian and 
C does not, and this contradiction shows that there is no curve over Fg with Weil 
polynomial x'^ — qx^ + q^ . 

This completes the proof of Theorem 11.11 in the case that d is even. We now 
turn to the case in which d is odd. The results when q = 3 can be obtained by 
enumerating all of the supersingular genus-2 curves over F3 and computing their 
Weil polynomials, so we will assume that q > 3. 

Let us begin by giving examples of curves whose Weil polynomials comprise all 
the polynomials given in the first list of Theorem 11.11 

Items (1) and (2): The split polynomials. Let cq, ci, and 02 be nonzero elements 
of Fq whose traces to F3 are 0, 1, and 2, respectively. Using Lemma lTTl and Tabled 
it is easy to check that the curve Ci^d has Weil polynomial 

{x^ + q){x'-{-lY^+'^/'V3^x + q), 
that the curve Ci^c2 has Weil polynomial 

{x^ + q){x^ + (-l)('*+l)/2y3^^ ^ ^)^ 
and that the curve Ci.c(, has Weil polynomial 

Item (3): The polynomial x^ + q^. We calculate that the supersingular curve 
y'^ — z^ + 1 over F3 has Weil polynomial x'^ + 9. It follows that the Weil polynomial 
for this curve over ¥q is x^ + q^ whenever q is an odd power of 3. 

Item (4): The polynomial x'^ + qx'^ + q^. Let a be an element of Fg whose absolute 
trace is nonzero. Let i S Fg be a square root of —1, let b be the element za^ of ¥^2, 
and let c = —a*. Let C be the curve 

over Fg. Note that over Fg2 we have 

z^ + a^z^ + a^^z + a^^ + a^^ = {z^ -ia^z'^ + a'^z-ia^ -a^){z^ + ia'^z'^ + a'^z + ia^ -a^) 

so that Cf 2 — Cb^c- If we identify Cb,c with Cf 2 in the obvious way then the 
Galois group of Fg2 over ¥q interchanges the two morphisms ip^.c '■ C — > Eb,c and 
^'bc'- C ^> E-b,c- It follows that the isogeny 

Jac Cf 2 ^^ Eb,c x E-b,c 

over Fg2 descends to give an isogeny 

JacC -^ ResF 2/F5 Eb,c 
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from the Jacobian of C to the restriction of scalars of Eb^c- Since i is a square but 
not a fourth power in Fg, it is easy to see that X(;2,4(Ja^) = —1. It is also easy to 
check that 

TrF,2/F3 c/6^/^ = TrF_^2/F3(l - i)a = Trr^/^^ TrF^a/FgCl " *)« 

— TrFg/F3(l — i) TiF^a/Fg a = Tr]fg/]F3(1 - i) Tr^^/pg a 
= - TrF,/F3 a ^ 0, 

so by Table 121 we sec that the Weil polynomial for E^^c is x^ + qx + q^ . It follows 
that the Weil polynomial for Rcsf ^ /f E^^c is x^ + qx"^ + Q^, so Jac C has this Weil 
polynomial as well. 

(Note that the quadratic twist of this C also has Weil polynomials a;** + qx^ + q^ . 
By rescaling the variables in the equation for the twist, we find that 

y'^ = z^ + a^z^ + a^z + d^ + 1 

has Weil polynomial x^ + qx"^ + q^ whenever a is an element of F^ whose absolute 
trace is nonzero.) 

Item (5): The polynomial x^ — 2qx^+q^. We use a similar construction to produce 
a curve with Weil polynomial x^ — 2qx^ + q^. Let a € Fg be a nonzero element 



whose absolute trace is 0, let i e Fg be as above, and again take b = ia} e Fg2 and 
-a^. We again find that the curve C over Fg defined by 



y^ ^ z^ ^ c?z^ + a^z + a"* + 1 

has Jacobian isogenous to the restriction of scalars of i?fe,cj but now Table El shows 
that the Weil polynomial of i?;,,c is x^ — 2qx^<^ . It follows that the Weil polynomial 
of Cisa;4-2ga;2+q2. 

To complete the proof of Theorem ll.il we must show that no curve over Fg has 
Weil polynomial 

(x^ — £i-\/3g + q){x^ — e2\/3g + <?) 

for any choice of ei,£2 G {Ij^l}- Suppose, to obtain a contradiction, that C is 
a curve over Fg with such a Weil polynomial. Write C as y^ = f for a degree- 
6 polynomial / g Fg[2]. Note that / is not the product of a linear polynomial 
with an irreducible quintic, because if this were the case the minimal polynomial 
of Ftobenius on the 2-torsion of C would he x'^ + x^ + x"^ + x + 1. By enumerating 
the other possible factorization for /, we see that over Fg2 , the polynomial / can 
be written a product of two (not-necessarily-irreducible) cubics. Therefore, by 
Theorems 13.41 and 13.21 Cw ^ is isomorphic to Cb,c for some 5, c G F*2. 
A simple computation shows that the Weil polynomial for CV ^ is 

/ 2 I 2\2 

(a; -qx + q ) , 

so Lemma l?m and TableOshow that Xq^,ii^) ~ Xq^,4(~^) ^ ^ ^^'^ ^^^^ *^® traces 
of cj}?!'^ and of c/{—bf'/'^ from Fg2 to F3 are nonzero. Using Lemma f3. 51 we can 
assume without loss of generality that 6=1. Then we know that Trp 2/F3 c 7^ 0, 
and in particular Tr^- ^/Fg c is nonzero. 
Equation Q tells us that 

, _ (c8 + l)5 
-'c -^ — ■ 
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In particular, we note that Ic ^ 0, because the roots of z^ + 1 generate Fgi, and 
¥q2 is not an extension of Fsi. It follows from Theorem 12. 2r c^ that the geometric 
automorphism group of C has order 2. We also know that Ic is an element of Fg, 
because C is a curve over Fg. 

Using Lemma FS. 41 fbelow). we see that there is an element c € Fg such that 

(c8 + 1)5 



^36 



±/r 



If the equality holds with the plus sign, take b = 1; if it holds with the minus sign, 
take b = i, where z is a square root of —1 in Fg. Then we have Ic-- = Ic- 

We claim that there is a curve D over Fg such that Dr 2 =^ ^ic- If ^ = 1 then 
this is obvious. If 6 = i, then we note that Cj- is defined by the equation 

2/^ = c{z^ - iz^ + z - i - c'^){z^ + iz'^ + z + i - c^) 

= ciz'^ + c'^zJ + c'^z + c'' + 1), 

so we can take D to be the curve over Fg defined by this equation. 

The fact that Id = Ic shows that 13 is a twist of C; since the geometric au- 
tomorphism group of C has order 2 the only nontrivial twist of C is the standard 
quadratic twist. This shows that the Weil polynomial of the curve D is of the form 

(5) {x'^ -^el^/3q + q){x'^ -^e2^/3q + q) 
for some £1,^2 G {!) ^l}j a-nd the Weil polynomial of Dr 2 is 

(6) {x^^qx + q^. 

If 6 = 1, then we see from Lemma [3. II and Tabled that the Weil polynomial of 
D cannot be of the form given by ^. Iib = i, then we note that Xq^.^ii) — —1, 
so that Lemma [3. II and Table |21 show that the Weil polynomial of D^ 3 cannot be 
of the form given by ^ . These contradictions shows that there can be no curve C 
over Fg with Weil polynomial 

{x^ - el^/3^ + q){x^ - e2^/3^ + q) 

for any choice of £1, £2 G {1, ^1}- D 

We end by proving the three lemmas that we needed in the preceding proof. 

Lemma 5.2. Let r be a power of an odd prime p, and let q be a power of r. If 
c e Fg2 \ Fg satisfies (c'-i + l)(r+l)/2 l^r(r-l)/2 g ^^^ ^^^^ Trp^^^ /F. c = 0. 

Proof. Let G = PSL2(Fr), and consider the rational function 

_ {{Z^ - Zf-^ + 1)^''+^)/" _ (^r-^ _ ,)ir+l)/2 
^ - (z- - z)'-('-l)/2 " (z'--z)('-' + l)/2- 

It is easy to verify that F is fixed by the action of G on Fr(z) by fractional linear 
transformations. Since the degree of F is equal to #G, we know that for every 
zq G Fr, the roots of F{z) — F{zq) in F^ are precisely the images of zq under the 
action of G. Furthermore, if -F(zo) is nonzero then one can verify that 

((z'' - zf-^ + if+^^/^ - F{za){z'- - z)^('-i)/2 
is a separable polynomial, so G acts faithfully on the roots of F[z) — F{zq). 
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Let c be as in the statement of the lemma. Suppose that the trace of c to ¥r 
were not 0. Then the polynomial z^ — z — c would have no roots in Fg2, so all of 
the roots oi z^ — z — c live in an extension of ¥^2 of degree divisible by p. Let d 
be such a root, and let n = [¥q{d) : Fg], so that n is a multiple of 2p. Then the 
hypothesis of the first statement of the lemma is that F{d) £ ¥q. 

Since d'^ is another root of F{z) — F{d), we know there is an element a of 
PSL2(Fr) so that d"^ = cr{d). The element cr of G is fixed by the action of the 
absolute Galois group of Fg, so we find that d"^ — <T^{d) for all integers i > 0. Thus 
a^ is the smallest power of a that fixes d. In particular, the order of a is a multiple 
of 2p. But there are no elements of order 2p in G, because there are no involutions 
in G that commute with a nontrivial translation. This contradiction proves the 
lemma. D 

Lemma 5.3. Let r be a power of an odd prime p, and let Q be a power of r. 
Suppose c e ¥q satisfies Tr^Q/F^c = 0, and let e = {d'-^ + i){r+i)/2/^r(r-i)/2^ 
Then the polynomial 

splits completely over ¥q . 

Proof. Since Tip /p^ = 0, there is a d G Fg with c = d^ — d. Let F be as in the 
preceding proof. Then all of the zeroes of the function F{z) — F{d) = F{z) — e 
lie in Fg , and it follows that the polynomial in the statement of the lemma splits 
completely. D 

Lemma 5.4. Let q be an odd power of 3. Suppose c G Fq2 \ ¥q satisfies (c^ + 
1)^/0"^^ e Fg and that Trp 2/Fo(c) is nonzero. Then there is ac €¥q such that 



Proof We use many of the ideas from the proof of Lemma 1^?^ Let G = PSL2(Fg) 
and let F be the rational function 

(z9-z)36 (z9-z)41' 

Since the trace of c to Fg is nonzero, we know that the polynomial z^ — z — c over 
Fg2 factors as a product of cubics. Let d be an element of Fg with d^ — d = c. Then 
¥q{d) is a degree-6 extension of Fg. 
Let e — F[d) so that 

Then d is a root of the rational function F{z) — e in Fg(z), so d"^ is another root of 
this function. By the reasoning from the proof of Lemma f5. 21 we see that there is 
an element a £ G with d' = a{d). Let ct denote the image of a under the action of 
Ga^Fg/Fa) on G. Then {aa)^ acts trivially on d, but no smaller power of {^a) acts 
trivially. It follows that a a has order 3. Enumerating the elements cr of G with this 
property, we find that there are elements t and p of G such that a — fpr^^ and 

'l 1 + A f-l + i l + i^ 



P^ ^ \{) 1 y ' V l+i 

Let d' = T^^{d), so that d' is yet another root of F{z) — e, but now {d'Y = p(d'). 
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If p{d') = d' + 1 + i then take c — {d')^ — d' . It is easy to check that c G F, and 
that 

(c^ + 1)5 _ (cS + 1)5 

If p{d') = id' + 1 then take c = (1 + i)d' . Then again we have c G Fg, but now 

(c8 + 1)5 (c8 + 1)5 



[1 

[2; 

[3; 

[4 

[6: 

[7; 

[9 

[lo: 

[11 

[12; 
[is; 

[14 

[is; 
[16; 
[17: 
[is; 

[19 

[2o; 

[21 

[22; 
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